What are you talking about? Taken to its logical conclusion you would have sites support passwords up to a million characters or else it is a sign that they are insecure. Having some limit is perfectly sane.

I also find it a bit "armchair quarterbacky" to be calling out PayPal on security practices. They've been around the block a few times, and though I certainly don't love them, they aren't making rookie mistakes like not-hashing passwords or the like.

You are just spreading FUD for no discernable reason. 20 characters while not the epitome of greatness, isn't a sign of the end times.